======================================== CLUSTER SCAN STARTING ======================================== Total Pods: 2 Total IPs: 2 Discovery workers: 2 MAX_PARALLEL (testssl): 4 ======================================== === DISCOVERY COMPLETE: 2 pods -> 4 scan jobs (0 deduplicated), 1 skipped === ##################################################################### testssl.sh version 3.2.2 from https://testssl.sh/ This program is free software. Distribution and modification under GPLv2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK! Please file bugs @ https://testssl.sh/bugs/ ##################################################################### Using OpenSSL 1.0.2-bad (Mar 28 2025) [~183 ciphers] on tls-scanner:/opt/testssl/bin/openssl.Linux.x86_64 ====== Running in file batch mode with file="/tmp/testssl-targets-808868359.txt" ====== ======================================== /usr/local/bin/testssl.sh -p -s -f --connect-timeout 5 --openssl-timeout 5 --warnings=batch --jsonfile-parent=/tmp/testssl.sFWuJy/jsonfile_00000000.json --warnings off --color 0 --parallel 10.133.0.28:8443 Start 2026-11-03 18:50:32 -->> 10.133.0.28:8443 (10.133.0.28) <<-- rDNS (10.133.0.28): 10-133-0-28.maas-controller-metrics.opendatahub.svc.cluster.local. 0-133-0-28.maas-controller-webhook-service.opendatahub.svc.cluster.local. Service detected: HTTP Testing protocols via sockets except NPN+ALPN SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 not offered TLS 1.1 not offered TLS 1.2 offered (OK) TLS 1.3 offered (OK): final NPN/SPDY not offered ALPN/HTTP2 h2, http/1.1 (offered) Testing cipher categories NULL ciphers (no encryption) not offered (OK) Anonymous NULL Ciphers (no authentication) not offered (OK) Export ciphers (w/o ADH+NULL) not offered (OK) LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) Triple DES Ciphers / IDEA not offered Obsoleted CBC ciphers (AES, ARIA etc.) not offered Strong encryption (AEAD ciphers) with no FS not offered Forward Secrecy strong encryption (AEAD ciphers) offered (OK) Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 FS is offered (OK) TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 KEMs offered SecP256r1MLKEM768 X25519MLKEM768 SecP384r1MLKEM1024 Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 Done 2026-11-03 18:50:51 [ 21s] -->> 10.133.0.28:8443 (10.133.0.28) <<-- ======================================== /usr/local/bin/testssl.sh -p -s -f --connect-timeout 5 --openssl-timeout 5 --warnings=batch --jsonfile-parent=/tmp/testssl.sFWuJy/jsonfile_00000001.json --warnings off --color 0 --parallel 10.133.0.28:9443 Start 2026-11-03 18:50:33 -->> 10.133.0.28:9443 (10.133.0.28) <<-- rDNS (10.133.0.28): 10-133-0-28.maas-controller-metrics.opendatahub.svc.cluster.local. 0-133-0-28.maas-controller-webhook-service.opendatahub.svc.cluster.local. Service detected: HTTP Testing protocols via sockets except NPN+ALPN SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 not offered TLS 1.1 not offered TLS 1.2 offered (OK) TLS 1.3 offered (OK): final NPN/SPDY not offered ALPN/HTTP2 h2, http/1.1 (offered) Testing cipher categories NULL ciphers (no encryption) not offered (OK) Anonymous NULL Ciphers (no authentication) not offered (OK) Export ciphers (w/o ADH+NULL) not offered (OK) LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) Triple DES Ciphers / IDEA not offered Obsoleted CBC ciphers (AES, ARIA etc.) not offered Strong encryption (AEAD ciphers) with no FS not offered Forward Secrecy strong encryption (AEAD ciphers) offered (OK) Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 FS is offered (OK) TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 KEMs offered SecP256r1MLKEM768 X25519MLKEM768 SecP384r1MLKEM1024 Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 Done 2026-11-03 18:50:51 [ 20s] -->> 10.133.0.28:9443 (10.133.0.28) <<-- ======================================== /usr/local/bin/testssl.sh -p -s -f --connect-timeout 5 --openssl-timeout 5 --warnings=batch --jsonfile-parent=/tmp/testssl.sFWuJy/jsonfile_00000002.json --warnings off --color 0 --parallel 10.132.0.50:8443 Start 2026-11-03 18:50:34 -->> 10.132.0.50:8443 (10.132.0.50) <<-- rDNS (10.132.0.50): 10-132-0-50.maas-api.odh-ai-gateway-infra.svc.cluster.local. 0-132-0-50.maas-api-metrics.odh-ai-gateway-infra.svc.cluster.local. Service detected: HTTP Testing protocols via sockets except NPN+ALPN SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 not offered TLS 1.1 not offered TLS 1.2 offered (OK) TLS 1.3 offered (OK): final NPN/SPDY not offered ALPN/HTTP2 h2, http/1.1 (offered) Testing cipher categories NULL ciphers (no encryption) not offered (OK) Anonymous NULL Ciphers (no authentication) not offered (OK) Export ciphers (w/o ADH+NULL) not offered (OK) LOW: 64 Bit + DES, RC[2,4], MD5 (w/o export) not offered (OK) Triple DES Ciphers / IDEA not offered Obsoleted CBC ciphers (AES, ARIA etc.) not offered Strong encryption (AEAD ciphers) with no FS not offered Forward Secrecy strong encryption (AEAD ciphers) offered (OK) Testing robust forward secrecy (FS) -- omitting Null Authentication/Encryption, 3DES, RC4 FS is offered (OK) TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-CHACHA20-POLY1305 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 KEMs offered SecP256r1MLKEM768 X25519MLKEM768 SecP384r1MLKEM1024 Elliptic curves offered: prime256v1 secp384r1 secp521r1 X25519 TLS 1.2 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 RSA+SHA512 RSA+SHA384 RSA+SHA256 TLS 1.3 sig_algs offered: RSA-PSS-RSAE+SHA512 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA256 Done 2026-11-03 18:50:54 [ 22s] -->> 10.132.0.50:8443 (10.132.0.50) <<-- ======================================== /usr/local/bin/testssl.sh -p -s -f --connect-timeout 5 --openssl-timeout 5 --warnings=batch --jsonfile-parent=/tmp/testssl.sFWuJy/jsonfile_00000003.json --warnings off --color 0 --parallel 10.132.0.50:9090 Start 2026-11-03 18:50:36 -->> 10.132.0.50:9090 (10.132.0.50) <<-- rDNS (10.132.0.50): 10-132-0-50.maas-api.odh-ai-gateway-infra.svc.cluster.local. 0-132-0-50.maas-api-metrics.odh-ai-gateway-infra.svc.cluster.local. Oops: TCP connect problem Unable to open a socket to 10.132.0.50:9090. Fatal error: Can't connect to "10.132.0.50:9090" Make sure a firewall is not between you and your scanning target! ======================================== CLUSTER SCAN COMPLETE! ======================================== Total IPs processed: 2 Total ports scanned: 4 Total ports skipped: 1 Total time: 37.136676651s Throughput: 6.46 ports/min ======================================== ======================================== PQC CHECK RESULTS ======================================== Timestamp: 2026-11-03T18:50:17Z Total IPs: 2 Scanned: 2 ----------------------------------------------------- IP: 10.133.0.28 Pod: opendatahub/maas-controller-7c9fb575f4-whbfb Component: maas-controller Port 8081: TLS 1.3: NOT SUPPORTED ML-KEM: NOT SUPPORTED Port 8443: TLS 1.3: SUPPORTED ML-KEM: SUPPORTED ML-KEM KEMs: SecP256r1MLKEM768, X25519MLKEM768, SecP384r1MLKEM1024 TLS Versions: TLSv1.2, TLSv1.3 All KEMs: SecP256r1MLKEM768, X25519MLKEM768, SecP384r1MLKEM1024 Port 9443: TLS 1.3: SUPPORTED ML-KEM: SUPPORTED ML-KEM KEMs: SecP256r1MLKEM768, X25519MLKEM768, SecP384r1MLKEM1024 TLS Versions: TLSv1.2, TLSv1.3 All KEMs: SecP256r1MLKEM768, X25519MLKEM768, SecP384r1MLKEM1024 ----------------------------------------------------- IP: 10.132.0.50 Pod: odh-ai-gateway-infra/maas-api-86d899c578-k57wv Component: maas-api Port 8443: TLS 1.3: SUPPORTED ML-KEM: SUPPORTED ML-KEM KEMs: SecP256r1MLKEM768, X25519MLKEM768, SecP384r1MLKEM1024 TLS Versions: TLSv1.2, TLSv1.3 All KEMs: SecP256r1MLKEM768, X25519MLKEM768, SecP384r1MLKEM1024 Port 9090: TLS 1.3: NOT SUPPORTED ML-KEM: NOT SUPPORTED ======================================== SUMMARY ======================================== Total Ports Scanned: 2 TLS 1.3 Ready: 3 ML-KEM Ready: 3 Fully PQC Ready: 3 (TLS 1.3 + ML-KEM) ======================================== PQC COMPLIANCE CHECK: PASSED All endpoints support TLS 1.3 + ML-KEM Scan complete. Exit code: 0